Java memory horse detection method and device, medium and electronic equipment
By inserting security plug-ins in Java virtual machines, regularly scanning Java classes and matching sample information, the problems of low detection efficiency of Java memory horses and large computing resource occupancy in the existing technology are solved, and efficient malicious class recognition is achieved.
Patent Information
- Application Number
- CN202311595659.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-09-22
- Filing Date
- 2023-11-27
- Publication Date
- 2025-03-25
AI Technical Summary
When detecting Java memory horses, the computing resources occupies a large amount of timely and effectively determines the memory horses present in the device.
Through the security plug-in instrumented in the target program, the Java class in the Java virtual machine is scanned safely at a predetermined time interval, the Java class to be detected is identified, its class information is obtained, and the sample information of the known memory horse is matched. If the similarity reaches or exceeds the predetermined threshold, it is determined to be a malicious class.
While reducing the use of computing resources, the detection efficiency of Java memory horses is improved and the existing malicious classes can be identified in a timely manner.
Smart Images
Figure CN119691739A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of application security technology, and in particular to a Java memory horse detection method, device, medium and electronic device. Background Art
[0002] A memory Trojan is a Trojan that runs only in memory and has no files landed or can delete itself after running. In current technical solutions, host-level memory scanning technology or memory hardware inspection solutions are often used to determine the memory Trojans present in the device. However, the above methods not only take up a lot of computing resources, but also fail to effectively and timely determine the memory Trojans present in the device. Therefore, how to reduce the computing resources occupied by memory Trojan determination while improving the detection efficiency of memory Trojans has become a technical problem that needs to be solved urgently. Summary of the invention
[0003] The embodiments of the present application provide a Java memory horse detection method, device, medium and electronic device, which can improve the memory horse detection efficiency while reducing the computing resources occupied by memory horse determination, at least to a certain extent.
[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.
[0005] According to one aspect of an embodiment of the present application, a method for detecting a Java memory bug is provided, the method comprising:
[0006] Perform security scans on Java classes in the Java virtual machine at predetermined time intervals according to the security plug-in inserted in the target program;
[0007] In each security scan, the Java class to be detected is identified from all scanned Java classes based on the predetermined identification rules;
[0008] Acquire class information of each Java class to be detected, wherein the class information includes source code of the Java class to be detected;
[0009] Matching the class information of each Java class to be detected with the sample information of the known memory horse one by one, and determining the similarity between the class information of the Java class to be detected and each sample information;
[0010] If the similarity between the Java class to be detected and any of the sample information is greater than or equal to a predetermined threshold, the Java class to be detected is determined to be a malicious class.
[0011] In one aspect of the present application, a Java memory horse detection device is provided, the device comprising:
[0012] A scanning module, used to perform security scanning on Java classes in a Java virtual machine at predetermined time intervals according to a security plug-in inserted in a target program;
[0013] An identification module, used to identify the Java class to be detected from all scanned Java classes based on a predetermined identification rule in each security scan;
[0014] An acquisition module, used for acquiring class information of each Java class to be detected, wherein the class information includes source code of the Java class to be detected;
[0015] A matching module, used for matching the class information of each Java class to be detected with the sample information of the known memory horse one by one, and determining the similarity between the class information of the Java class to be detected and each sample information;
[0016] The processing module is configured to determine that the Java class to be detected is a malicious class if the similarity between the Java class to be detected and any of the sample information is greater than or equal to a predetermined threshold.
[0017] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for detecting a Java memory horse as described in the above embodiment is implemented.
[0018] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the Java memory horse detection method as described in the above embodiments.
[0019] According to one aspect of an embodiment of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the Java memory horse detection method provided in the above embodiment.
[0020] In the technical solutions provided by some embodiments of the present application, according to the security plug-in inserted in the target program, a security scan is performed on the Java class in the Java virtual machine at predetermined time intervals. In each security scan, based on the predetermined identification rules, the Java class to be detected is identified from all the scanned Java classes, and then the class information of each Java class to be detected is obtained, and the class information includes the source code of the Java class to be detected, and the class information of each Java class to be detected is matched one by one with the sample information of the known memory horse, and the similarity between the two is determined. If any corresponding similarity is greater than or equal to the predetermined threshold, the Java class to be detected is determined to be a malicious class. Thus, the memory horse is scanned and identified during the operation of the target program, and there is no need to scan the entire device, which reduces the computing resources required for the determination of the memory horse. And the Java class to be detected is first determined, and then the class information of the Java class to be detected is compared with the sample information of the known memory horse, so as to determine the malicious class existing in the Java class to be detected, which reduces the amount of data required for comparison and improves the detection efficiency of the memory horse.
[0021] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:
[0023] Figure 1 A schematic diagram of a process flow of a Java memory horse detection method according to an embodiment of the present application is shown;
[0024] Figure 2 A block diagram of a Java memory horse detection device according to an embodiment of the present application is shown;
[0025] Figure 3 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION
[0026] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.
[0027] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.
[0028] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.
[0029] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.
[0030] Figure 1 A flow chart of a Java memory horse detection method according to an embodiment of the present application is shown. The method can be applied to a terminal device or a server, wherein the terminal device can be one or more of a smart phone, a tablet computer, a portable computer or a desktop computer, and the server can be a physical server or a cloud server.
[0031] It should be noted that the above-mentioned terminal devices or servers can be of any number. For example, the server can be a server cluster composed of multiple servers, etc. This application does not impose any special limitation on this.
[0032] like Figure 1 As shown, the Java memory horse detection method at least includes steps S110 to S150, which are described in detail as follows (the following is an example of the method being applied to a terminal device):
[0033] In step S110, according to the security plug-in inserted in the target program, a security scan is performed on the Java class in the Java virtual machine at every predetermined time interval.
[0034] The target program may be an application program that needs to be tested for Java memory errors, such as a web application, etc. It should be noted that the target program may be one or more, that is, the present application may also perform Java memory error detection on multiple target programs at the same time, without any special limitation.
[0035] The security plug-in can insert a stub into the target program. After the insertion, it can obtain relevant information of the target program when it is running, for example, it can scan the Java class information of the target program running in the Java virtual machine.
[0036] In this embodiment, the administrator can insert the security plug-in into the target program to obtain relevant information when the target program is running. Specifically, the security plug-in can perform a security scan on the Java class in the Java virtual machine at a predetermined time interval. The predetermined time interval can be predetermined by those skilled in the art based on prior experience, for example, the predetermined time interval can be 5 minutes, 10 minutes, etc. It should be noted that the above numbers are only illustrative examples and are not specifically limited to this.
[0037] The security scan may include determining the Java classes and related information running in the Java virtual machine. In one example, the security plug-in may determine the Java classes and related information corresponding to the target program based on the package name corresponding to the target program, thereby achieving the purpose of targeted identification.
[0038] In step S120, in each security scan, the Java class to be detected is identified from all scanned Java classes based on a predetermined identification rule.
[0039] In this embodiment, after the security plug-in filters out the Java class corresponding to the target program from the Java virtual machine, it can identify the Java class to be detected from all scanned Java classes based on predetermined identification rules. It should be noted that compared with other Java classes, the Java class to be detected has a greater risk of being infected by a memory horse. Therefore, performing Java memory horse detection on it can ensure the targeted detection and the accuracy of the detection results.
[0040] In one embodiment, the predetermined identification rules include at least one of a class name blacklist, dangerous annotations, and dangerous parent classes and interfaces. Those skilled in the art may pre-set the above-mentioned predetermined identification rules based on prior experience, and store them for subsequent calls. When performing a security scan, the security plug-in may compare each scanned Java class with the predetermined identification rules to identify the class to be detected from all Java classes. For example, the security plug-in may compare the class name of the scanned Java class with the class name blacklist. If the same class name exists in the class name blacklist, the Java class is identified as a Java class to be detected.
[0041] In step S130, class information of each Java class to be detected is obtained, where the class information includes the source code of the Java class to be detected.
[0042] In this embodiment, class information of each Java class to be detected is obtained according to the determined Java class to be detected, and the class information may include but is not limited to the source code of the Java class to be detected. In one example, the source code of the Java class to be detected can be obtained by adding a ClassFileTransformer to the instrumentation, executing its transform method to obtain the source code byte array of the Java class to be detected, and then converting it into a string, thereby obtaining the source code of the Java class to be detected.
[0043] In other embodiments, the class information of the Java class to be detected also includes basic information of the class of the Java class to be detected, the type of Java memory horse determined by analyzing the inheritance relationship of the class, etc. Those skilled in the art can determine the acquired class information according to actual implementation requirements, and there is no special limitation on this.
[0044] In step S140, the class information of each Java class to be detected is matched with the sample information of the known memory horse one by one to determine the similarity between the class information of the Java class to be detected and each sample information.
[0045] In this embodiment, the administrator can obtain the class information of the infected memory malware class in advance and use it as the sample information of the known memory malware for subsequent comparison. It should be understood that the sample information of the known memory malware can be one or two or more than two, and there is no special limitation on this.
[0046] In one embodiment, the sample information of the known memory horse can be converted into a corresponding information vector, and accordingly, the class information of the Java class to be detected is also converted into a corresponding information vector, and the two information vectors are compared to determine the similarity between the two. In one example, the similarity between the two information vectors can be determined by calculating the cosine similarity or Euclidean distance between the two information vectors.
[0047] It should be understood that the higher the similarity, the higher the possibility that the Java class to be detected is infected by the known memory horse.
[0048] In step S150, if the similarity between the Java class to be detected and any of the sample information is greater than or equal to a predetermined threshold, it is determined that the Java class to be detected is a malicious class.
[0049] In this embodiment, according to the matching result, if the similarity between the Java class to be detected and any sample information is greater than or equal to a predetermined threshold, it means that the Java class to be detected is highly likely to be infected and can be regarded as a malicious class.
[0050] It should be noted that the predetermined threshold may be predetermined by a person skilled in the art based on prior experience, and is used to determine a lower limit of the similarity between the sample information of the infected Java class to be detected and the known memory horse.
[0051] Therefore, according to Figure 1 In the embodiment shown, according to the security plug-in inserted in the target program, a security scan is performed on the Java classes in the Java virtual machine at predetermined time intervals. In each security scan, based on the predetermined identification rules, the Java class to be detected is identified from all the scanned Java classes, and then the class information of each Java class to be detected is obtained, and the class information includes the source code of the Java class to be detected, and the class information of each Java class to be detected is matched one by one with the sample information of the known memory horse, and the similarity between the two is determined. If any corresponding similarity is greater than or equal to the predetermined threshold, the Java class to be detected is determined to be a malicious class. Thus, the memory horse is scanned and identified during the operation of the target program, and there is no need to scan the entire device, which reduces the computing resources required for the determination of the memory horse. And the Java class to be detected is first determined, and then the class information of the Java class to be detected is compared with the sample information of the known memory horse, so as to determine the malicious class existing in the Java class to be detected, which reduces the amount of data that needs to be compared and improves the detection efficiency of the memory horse.
[0052] In one embodiment of the present application, the method further includes:
[0053] Adding the newly determined malicious class to the malicious class list;
[0054] For the newly added malicious class in the malicious class list, the malicious class is retained in the Java virtual machine, and the malicious method in the bytecode of the malicious class is modified.
[0055] In this embodiment, when a certain Java class to be detected is determined to be a malicious class, the class name of the newly determined malicious class can be added to the malicious class list. The terminal device can periodically retain the newly added malicious class in the malicious class list in the Java virtual machine, and modify the malicious method in the bytecode of the malicious class, thereby modifying the malicious method in the malicious class to make it invalid. In one example, the malicious method in the malicious class can be determined based on the function call relationship and / or behavioral characteristics. It should be understood that retaining the malicious class in the Java virtual machine can prevent business anomalies.
[0056] In one embodiment, when modifying a malicious method of a malicious class, a ClassFileTransformer may be added to the instrumentation to retransform the newly added malicious class in the malicious class list.
[0057] Specifically, the JVMTI technology is used to obtain the instrument object of the JVM, and the instrument is used to implant the ClassFileTrantsformer class that customizes the bytecode modification. The ClassFileTrantsformer is used to rewrite the bytecode of the specified malicious method of the malicious class, thereby achieving the purpose of clearing.
[0058] In one embodiment of the present application, modifying the malicious method in the bytecode of the malicious class includes:
[0059] Determine the known memory malware corresponding to the sample information having the greatest similarity to the malicious class as the target memory malware;
[0060] The class accessor and method accessor corresponding to the target memory horse are called to enhance the method function corresponding to the malicious class.
[0061] In this embodiment, the terminal device can determine the known memory horse corresponding to the sample information with the greatest similarity to the malicious class as the target memory horse, and then call the class accessor and method accessor corresponding to the target memory horse, so as to enhance the method function corresponding to the malicious class through the ClassFileTransformer through the class accessor and method accessor, thereby achieving the purpose of making the malicious method of the malicious class invalid.
[0062] That is, those skilled in the art can construct corresponding class accessors and method accessors for different known memory horses based on prior experience, thereby ensuring the effectiveness of subsequent modifications.
[0063] In one embodiment of the present application, after modifying the malicious method in the bytecode of the malicious class, the method further includes:
[0064] If it is detected that the business corresponding to the malicious class is abnormal, the malicious class is deleted from the malicious class list and the malicious class is retransformed.
[0065] In this embodiment, when it is detected that a certain service has an abnormality due to the modification of a malicious class, such as the interface cannot be accessed normally, the corresponding malicious class can be deleted from the malicious class list and retransformed to repair the service, reduce the occurrence of malicious class miskilling, and ensure the normal operation of the service.
[0066] In one embodiment of the present application, the class information of each Java class to be detected is matched with the sample information of the known memory horse one by one, and the similarity between the class information of the Java class to be detected and each sample information is determined, including:
[0067] The fuzzy hash algorithm is used to match the class information of each Java class to be detected with the sample information of the known memory horse one by one, and the similarity between the class information of the Java class to be detected and each sample information is determined.
[0068] In this embodiment, the terminal device can use a fuzzy hash algorithm (such as the ssdeep algorithm, etc.) to match the class information of each Java class to be detected with the sample information of the known memory horse one by one, so as to determine the similarity between the two, thereby improving the matching efficiency and the accuracy of the matching result.
[0069] In one embodiment, when a malicious class is detected or a corresponding cleanup is performed on the malicious class, corresponding process information can be generated. The present application can provide an information display interface to display the process information so that management personnel can review and operate the process information, such as revoking or reporting.
[0070] The following describes an apparatus embodiment of the present application, which can be used to execute the Java memory horse detection method in the above embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above embodiment of the Java memory horse detection method of the present application.
[0071] Figure 2 A block diagram of a Java memory horse detection device according to an embodiment of the present application is shown.
[0072] Reference Figure 2 As shown, according to an embodiment of the present application, a Java memory horse detection device includes:
[0073] A scanning module, used to perform security scanning on Java classes in a Java virtual machine at predetermined time intervals according to a security plug-in inserted in a target program;
[0074] An identification module, used to identify the Java class to be detected from all scanned Java classes based on a predetermined identification rule in each security scan;
[0075] An acquisition module, used for acquiring class information of each Java class to be detected, wherein the class information includes source code of the Java class to be detected;
[0076] A matching module, used for matching the class information of each Java class to be detected with the sample information of the known memory horse one by one, and determining the similarity between the class information of the Java class to be detected and each sample information;
[0077] The processing module is configured to determine that the Java class to be detected is a malicious class if the similarity between the Java class to be detected and any of the sample information is greater than or equal to a predetermined threshold.
[0078] In one embodiment of the present application, the processing module is further used for:
[0079] Adding the newly determined malicious class to the malicious class list;
[0080] For the newly added malicious class in the malicious class list, the malicious class is retained in the Java virtual machine, and the malicious method in the bytecode of the malicious class is modified.
[0081] In one embodiment of the present application, modifying the malicious method in the bytecode of the malicious class includes:
[0082] Determine the known memory malware corresponding to the sample information having the greatest similarity to the malicious class as the target memory malware;
[0083] The class accessor and method accessor corresponding to the target memory horse are called to enhance the method function corresponding to the malicious class.
[0084] In one embodiment of the present application, after modifying the malicious method in the bytecode of the malicious class, the processing module is further used to:
[0085] If it is detected that the business corresponding to the malicious class is abnormal, the malicious class is deleted from the malicious class list and the malicious class is retransformed.
[0086] In one embodiment of the present application, the predetermined identification rule includes at least one of a class name blacklist, a dangerous annotation, and a dangerous parent class and interface.
[0087] In one embodiment of the present application, the matching module is used to: use a fuzzy hash algorithm to match the class information of each Java class to be detected with the sample information of the known memory horse one by one, and determine the similarity between the class information of the Java class to be detected and each sample information.
[0088] Figure 3 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.
[0089] It should be noted that Figure 3 The computer system of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.
[0090] like Figure 3 As shown, the computer system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method described in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through bus 304. Input / output (I / O) interface 305 is also connected to bus 304.
[0091] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.
[0092] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 309, and / or installed from a removable medium 311. When the computer program is executed by a central processing unit (CPU) 301, various functions defined in the system of the present application are executed.
[0093] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.
[0094] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0095] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.
[0096] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.
[0097] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.
[0098] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.
[0099] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.
[0100] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.
Claims
1. A method for detecting a Java memory bug, characterized in that: include: Perform security scans on Java classes in the Java virtual machine at predetermined time intervals according to the security plug-in inserted in the target program; In each security scan, the Java class to be detected is identified from all scanned Java classes based on the predetermined identification rules; Acquire class information of each Java class to be detected, wherein the class information includes source code of the Java class to be detected; Matching the class information of each Java class to be detected with the sample information of the known memory horse one by one, and determining the similarity between the class information of the Java class to be detected and each sample information; If the similarity between the Java class to be detected and any of the sample information is greater than or equal to a predetermined threshold, the Java class to be detected is determined to be a malicious class.
2. The method according to claim 1, characterized in that The method further comprises: Adding the newly determined malicious class to the malicious class list; For the newly added malicious class in the malicious class list, the malicious class is retained in the Java virtual machine, and the malicious method in the bytecode of the malicious class is modified.
3. The method according to claim 2, characterized in that Modifying the malicious method in the bytecode of the malicious class, including: Determine the known memory malware corresponding to the sample information having the greatest similarity to the malicious class as the target memory malware; The class accessor and method accessor corresponding to the target memory horse are called to enhance the method function corresponding to the malicious class.
4. The method according to claim 2, characterized in that: After modifying the malicious method in the bytecode of the malicious class, the method further includes: If it is detected that the business corresponding to the malicious class is abnormal, the malicious class is deleted from the malicious class list and the malicious class is retransformed.
5. The method according to any one of claims 1 to 4, characterized in that The predetermined identification rule includes at least one of a class name blacklist, a dangerous annotation, and a dangerous parent class and interface.
6. The method according to any one of claims 1 to 4, characterized in that Matching the class information of each Java class to be detected with the sample information of the known memory horse one by one, and determining the similarity between the class information of the Java class to be detected and each sample information, including: The fuzzy hash algorithm is used to match the class information of each Java class to be detected with the sample information of the known memory horse one by one, and the similarity between the class information of the Java class to be detected and each sample information is determined.
7. A Java memory horse detection device, characterized in that: include: A scanning module, used to perform security scanning on Java classes in a Java virtual machine at predetermined time intervals according to a security plug-in inserted in a target program; An identification module, used to identify the Java class to be detected from all scanned Java classes based on a predetermined identification rule in each security scan; An acquisition module, used for acquiring class information of each Java class to be detected, wherein the class information includes source code of the Java class to be detected; A matching module, used for matching the class information of each Java class to be detected with the sample information of the known memory horse one by one, and determining the similarity between the class information of the Java class to be detected and each sample information; The processing module is configured to determine that the Java class to be detected is a malicious class if the similarity between the Java class to be detected and any of the sample information is greater than or equal to a predetermined threshold.
8. The device according to claim 7, characterized in that The processing module is also used for: Adding the newly determined malicious class to the malicious class list; For the newly added malicious class in the malicious class list, the malicious class is retained in the Java virtual machine, and the malicious method in the bytecode of the malicious class is modified.
9. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the Java memory horse detection method according to any one of claims 1 to 6 is implemented.
10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the Java memory horse detection method as described in any one of claims 1 to 6.